4 ms·

Yes, they are! but also because the law sets the standard, it can also provide a new one. For example: a) you are still legally required to age verify online a

Yes, they are! but also because the law sets the standard, it can also provide a new one. For example: a) you are still legally required to age verify online alcohol purchases but b) it’s illegal to use information collected for that purpose for other purposes and c) Which information is collected is made legible by the user agents Maybe something around only collecting minimal data, too. Some of the first eager customers are banks with onerous KYC requirements – they want one click account creation! Good luck changing financial disclosure laws, though, my bank knows quite a bit about me.

AnthonyMouse 1y ago
> but also because the law sets the standard, it can also provide a new one. If the people writing the law cared about privacy they wouldn't have passed that one, and anybody who does would be repealing it rather than trying to find the best shade of lipstick for the pig. > Which information is collected is made legible by the user agents This is the part you don't need a law in order to do because the user can choose their user agent. Or if they can't, you should stop talking about any of this and go fix your antitrust problem. > you are still legally required to age verify online alcohol purchases but By conceding this you've already lost, because: > it’s illegal to use information collected for that purpose for other purposes This is the part which is hopeless. If they have the information, you're already screwed, because once they have it it's almost impossible for you or the government to know what they're doing with it, which makes those laws nearly impossible to enforce. And on top of that, a large part of the problem is what criminals or governments do once there is a legally-mandated database of all of that stuff, and those entities aren't constrained by laws. Which is why anybody who really cares about this knows that the only solution is to not have the law requires that data to be collected. > Good luck changing financial disclosure laws, though "Slippery slope is a fallacy", they said. "It's just one inch", they said.
- conradev 1y ago
  I figured I’d get this response, but: I don’t see my primary care doctor selling my health data, due in part to data privacy laws like HIPAA. Consumer companies take COPPA seriously. You absolutely cannot control what companies do with data, so you want to prevent its collection in the first place – but you can penalize them when they do something wrong, which does influence their beyavior. The jury is still out on the effectiveness of the GDPR, but to say it had no effect would be an odd claim.
  - roenxi 1y ago
    > I don’t see my primary care doctor selling my health data Without overstretching the metaphor, it is quite revealing - you wouldn't see your primary care doctor selling that information whether they are or aren't. You don't have an effective way of monitoring the situation. Nobody outside the hypothetical transaction does. It is common for that sort of situation to go bad if the economics of selling the data make sense despite the risk of getting caught.
    - conradev 1y ago
      Yeah, that totally makes sense! It is revealing: I went to same PCP for the first 18 years of my life and he was incredible as a doctor. He ran his own practice. He was also a great IT admin: he managed his own records, paid to digitize all of them including mine. If he betrayed that trust I’d be sad. But I hear you. A product just needs to come along that provides some benefit, or the practice could be acquired, etc
  - socalgal2 1y ago
    Every doctor I've been to makes me sign a paper that says I acknowledge all my data will be shared with all of their partners.
    - vel0city 1y ago
      That doesn't mean any of those other companies are buying or selling that data. The healthcare provider uses an EHR. They might have some managed service provider managing their IT assets and their EHR deployment. Two companies they have BAAs with. That EHR company could be cloud hosted, another BAA. They probably rely on other tools and contractors which might have BAAs. Later on when they go to bill they exchange that billing data through billing analysis tools (another BAA) and then submit to a clearing house (another BAA). All of those companies probably have companies they work with that potentially need BAAs as well, if they work directly with that PHI data in the role of working on behalf of that healthcare provider. One trip to the doctor could potentially involve dozens of companies you've never heard of that might have a business use case to handle your healthcare data in some way or fashion and none of them actually sold that data or mishandled it under HIPAA.

AnthonyMouse 1y ago

> but also because the law sets the standard, it can also provide a new one. If the people writing the law cared about privacy they wouldn't have passed that one, and anybody who does would be repealing it rather than trying to find the best shade of lipstick for the pig. > Which information is collected is made legible by the user agents This is the part you don't need a law in order to do because the user can choose their user agent. Or if they can't, you should stop talking about any of this and go fix your antitrust problem. > you are still legally required to age verify online alcohol purchases but By conceding this you've already lost, because: > it’s illegal to use information collected for that purpose for other purposes This is the part which is hopeless. If they have the information, you're already screwed, because once they have it it's almost impossible for you or the government to know what they're doing with it, which makes those laws nearly impossible to enforce. And on top of that, a large part of the problem is what criminals or governments do once there is a legally-mandated database of all of that stuff, and those entities aren't constrained by laws. Which is why anybody who really cares about this knows that the only solution is to not have the law requires that data to be collected. > Good luck changing financial disclosure laws, though "Slippery slope is a fallacy", they said. "It's just one inch", they said.

conradev 1y ago
I figured I’d get this response, but: I don’t see my primary care doctor selling my health data, due in part to data privacy laws like HIPAA. Consumer companies take COPPA seriously. You absolutely cannot control what companies do with data, so you want to prevent its collection in the first place – but you can penalize them when they do something wrong, which does influence their beyavior. The jury is still out on the effectiveness of the GDPR, but to say it had no effect would be an odd claim.
- roenxi 1y ago
  > I don’t see my primary care doctor selling my health data Without overstretching the metaphor, it is quite revealing - you wouldn't see your primary care doctor selling that information whether they are or aren't. You don't have an effective way of monitoring the situation. Nobody outside the hypothetical transaction does. It is common for that sort of situation to go bad if the economics of selling the data make sense despite the risk of getting caught.
  - conradev 1y ago
    Yeah, that totally makes sense! It is revealing: I went to same PCP for the first 18 years of my life and he was incredible as a doctor. He ran his own practice. He was also a great IT admin: he managed his own records, paid to digitize all of them including mine. If he betrayed that trust I’d be sad. But I hear you. A product just needs to come along that provides some benefit, or the practice could be acquired, etc
- socalgal2 1y ago
  Every doctor I've been to makes me sign a paper that says I acknowledge all my data will be shared with all of their partners.
  - vel0city 1y ago
    That doesn't mean any of those other companies are buying or selling that data. The healthcare provider uses an EHR. They might have some managed service provider managing their IT assets and their EHR deployment. Two companies they have BAAs with. That EHR company could be cloud hosted, another BAA. They probably rely on other tools and contractors which might have BAAs. Later on when they go to bill they exchange that billing data through billing analysis tools (another BAA) and then submit to a clearing house (another BAA). All of those companies probably have companies they work with that potentially need BAAs as well, if they work directly with that PHI data in the role of working on behalf of that healthcare provider. One trip to the doctor could potentially involve dozens of companies you've never heard of that might have a business use case to handle your healthcare data in some way or fashion and none of them actually sold that data or mishandled it under HIPAA.